Examkin

Soru

Zorluk: Çok zorHybrid and Multi-Account Network Connectivity Design

An enterprise is designing a high-availability hybrid network using a multi-account AWS environment across two Regions: `us-east-1` (Primary) and `us-west-2` (Secondary). Each Region contains a Transit Gateway (TGW) connecting local spoke VPCs. The TGW in `us-east-1` and the TGW in `us-west-2` are peered to allow inter-Region VPC-to-VPC traffic. The enterprise has an on-premises data center with a 10 Gbps10\text{ Gbps} AWS Direct Connect (DX) connection terminating at a DX location associated with `us-east-1`. A Direct Connect Gateway (DXGW) is configured with a Transit Virtual Interface (VIF) to connect to the on-premises router. The network team has the following requirements:
- Spoke VPCs in both `us-east-1` and `us-west-2` must have primary hybrid connectivity to the on-premises data center via the DX connection.
- A backup AWS Site-to-Site VPN must provide automated failover with minimum latency if the DX connection or Transit VIF goes down.
- Asymmetric routing between the data center and the AWS Regions must be prevented.

Which TWO configuration steps should the solutions architect implement to meet these requirements?

  1. Associate the Direct Connect Gateway with the Transit Gateways in both `us-east-1` and `us-west-2`. Terminate the backup Site-to-Site VPN connections directly on the Transit Gateway in each respective Region.Cevap
  2. Configure BGP over the Direct Connect Transit VIF and the VPN connections. On the on-premises router, set a higher local preference for prefixes received via the Direct Connect Gateway to ensure outbound traffic to AWS prefers the Direct Connect path.Cevap
  3. C
    Associate the Direct Connect Gateway only with the `us-east-1` Transit Gateway. In the `us-west-2` Transit Gateway route table, add a static route for the on-premises CIDR block pointing to the inter-Region Transit Gateway peering attachment.
  4. D
    Associate the Direct Connect Gateway with a Route 53 Resolver inbound endpoint in `us-east-1`. Use a Route 53 Private Hosted Zone associated with all spoke VPCs across both Regions to dynamically resolve and route on-premises traffic.
  5. E
    Deploy a single NAT Gateway in a shared services VPC in `us-east-1`. Route all outbound hybrid traffic from both Regions through the Transit Gateway peering connection to this NAT Gateway before forwarding to the Direct Connect Gateway.

Cevap

To establish a high-availability hybrid network across two Regions without asymmetric routing, associate the Direct Connect Gateway with the Transit Gateways in both Regions and establish Site-to-Site VPN connections terminating directly on each local Transit Gateway. On the on-premises router, configure BGP local preference to prioritize the routes received via the Direct Connect Gateway over the backup VPN connections.
Associating the Direct Connect Gateway with both Transit Gateways and establishing VPN connections terminating on each TGW ensures that both Regions have a direct path to the on-premises network, satisfying the non-transitive routing rule of Transit Gateway peering. Configuring BGP local preference on-premises ensures that outbound traffic to AWS prefers the Direct Connect path. This matches the inbound behavior where TGW route tables automatically prioritize Direct Connect gateway routes over VPN routes for identical prefixes, preventing asymmetric routing.

Adım Adım Çözüm

1
Analyze Transit Gateway peering transitive routing limitations.
Identify that spoke VPCs in the secondary region cannot transit the peering connection to reach a Direct Connect Gateway or VPN in the primary region.
AWS Transit Gateway does not support transitive routing between peering connections and hybrid connections.
2
Design the hybrid connectivity attachments for both Regions.
Associate the Direct Connect Gateway with both Transit Gateways and terminate VPN connections in both Regions.
Direct association and attachment are required to allow local egress and ingress for both Regions.
3
Address outbound routing from on-premises to AWS to prefer Direct Connect.
Configure BGP local preference on the customer gateway to prefer routes received via Direct Connect.
Prevent on-premises from routing traffic to AWS over the lower-bandwidth backup VPN connections.
4
Verify return path routing from AWS to on-premises.
AWS TGW route tables automatically prioritize Direct Connect gateway routes over VPN routes for the same prefix.
Ensures symmetric path alignment without requiring complex prefix prepending on the AWS side.

Anahtar Kavram

AWS Transit Gateway does not support transitive routing over peering connections to Direct Connect Gateways or VPNs; therefore, hybrid attachments must exist in each Region. BGP routing configuration is required to align inbound and outbound paths to prevent asymmetric routing.
Bu soruyu puanla

Konular

Hybrid and Multi-Account Network Connectivity Design

Bu konudan daha fazla soru